Fix HTML attribute parsing, discard attributes not strating with a letter
Status with HTML content like
<a title="foo"[1]>
gets normalized to <a title="foo"" 1=true>
and if received by pleroma-fe causes vue to set an attribute named "1", which fails on DOM setAttribute method.
In production mode this sends fe into endless error loop, making browser tab completely unresponsive.
This MR fixes the issue of attributes starting with non-letters being allowed.
Changes
- Fixes HTML attribute parser, allowing only attributes with leading letter.
Merge request reports
Activity
added 1 commit
- 06f3e1ae - Strip unbalanced attributes and digit-only attribute names in HTML content
added 1 commit
- de7e3297 - Strip unbalanced attributes and digit-only attribute names in HTML content
added 1 commit
- 3baed46a - Strip unbalanced attributes and digit-only attribute names in HTML content
added 1 commit
- a0d79faa - Fix HTML attribute parsing, discard attributes not strating with a letter
added 59 commits
-
a0d79faa...a1641193 - 58 commits from branch
pleroma:develop
- 9baffbfb - Fix HTML attribute parsing, discard attributes not strating with a letter
-
a0d79faa...a1641193 - 58 commits from branch
I may have not been clear about this, but the underlying issue can remotely and with little effort virtually disable access to pleroma fe for any account(s) by anyone publishing a specifically-formed status (from any instance that allows HTML status formatting). Unless any changes are required, merging it or proposing a better approach might be a good idea. The changes are rebased with latest develop.
Edited by iamtakingiteasymentioned in commit 1d679b59